What Happens If Binance Gets Hacked? SAFU, Past Hacks and What You Control

What happens if Binance gets hacked? People have typed that into Google for years as a what-if. On the evening of 29 October 2026 it briefly stopped being hypothetical: on-chain trackers flagged billions of dollars leaving wallets labelled as Binance's, the word "hack" did the rest, and BNB fell about 10.6% from the day's high before clawing part of it back. At the time of writing, Binance has confirmed nothing — no breach, and no explanation of the transfers either.

So this page does two jobs. First, a dated record of what is actually known about the 29 October outflows, kept separate from what is merely being claimed. Second — and this part stays true however the story resolves — what Binance's SAFU fund really is, how the five biggest exchange hacks in history ended for the people with balances on them, and which protections are yours to set no matter what any exchange does.

What we know about the 29 October outflows, and what nobody knows yet

This section was written on the evening of 29 October 2026 (UTC), while the story was hours old. The claims, with their status:

• Flagged, by third parties: on-chain trackers reported roughly $2.5–2.8 billion moving out of Binance-labelled wallets across five chains, with one tally reaching about $3.3 billion after a later 780 million USDC transfer. Specific transactions named include 167,464 ETH (about $388 million) out of the wallet Etherscan labels "Binance 14" and that 780M USDC out of "Binance: Hot Wallet 34" (reported by Crypto Briefing among others). None of these are Binance's own numbers.
• Claimed, disputed: that the wallet which triggered the transfers was funded only through Tornado Cash, a mixer — widely repeated, but a review of public chain data found nothing confirming an organized Tornado link.
• Claimed, unverified: that Tether and Circle froze roughly $1.8 billion of USDT and USDC combined. Both issuers can freeze tokens and have done so in past thefts; neither had published anything at the time of writing. If real freezes are confirmed on-chain, that is the strongest signal this was theft — issuers do not freeze an exchange's internal maintenance.
• Silent: neither Binance nor its CEO Richard Teng had commented. Worth knowing: Binance has disputed third-party outflow tallies before, and big exchanges genuinely do shuffle nine-figure sums between their own wallets as routine maintenance, which mislabelled wallet tags then turn into scary headlines.
• Context, cutting both ways: two days earlier Binance publicly said it had blocked a wave of North Korea-linked intrusion attempts with no assets lost. Either the attackers kept trying and got in, or the market just watched an exchange move its own money hours after priming everyone to think about hackers.

What settles it is short: a statement from Binance, the next proof-of-reserves snapshot, or issuer freezes visible on-chain. Until one of those lands, here is what the market did with the uncertainty:

Read the candles honestly and they say "rumor", not "verdict": a 10.6% plunge on the headline, about $600 million of leveraged longs liquidated within the hour, then a +4.7% bounce off the low once no confirmation followed. The market was pricing the possibility of a multi-billion hole, discounted by the live possibility that this is wallet maintenance with bad optics. We are not going to pretend to know which it is before Binance or the chain tells us.

Binance has been hacked before, and users lost nothing

The useful part of today's question is that it has a track record to answer with. On 7 May 2019, attackers took 7,000 BTC — about $40 million then — out of Binance's BTC hot wallet in one transaction, using a patient mix of phishing, malware, stolen API keys and two-factor codes. It was a real breach of the real Binance, not a rumor.

What happened to users is the part people forget: nothing. The stolen wallet held about 2% of Binance's bitcoin, the loss was charged to the exchange's SAFU emergency fund, every affected balance was made whole, and the main user-facing cost was withdrawals being paused for roughly a week while systems were rebuilt. The incident is why "funds are SAFU" became a crypto catchphrase rather than a punchline.

What the SAFU fund is, and what it is not

SAFU — the Secure Asset Fund for Users — is an emergency pool Binance has run since July 2018, originally built by diverting 10% of trading fees. Binance pegs it at about $1 billion, and since April 2024 it has been held entirely in USDC at a publicly visible on-chain address, so anyone can check it exists without trusting a press release.

Be equally clear about its limits. SAFU is Binance's own promise, not insurance: no regulator defines what it must cover, no law gives you a claim on it, and paying out is a decision Binance makes. A billion dollars also has to be read against scale — it covered the $40 million hack of 2019 forty times over, but it would cover only a fraction of an event the size of the one rumored today. A fund like this is a genuine, checkable security signal, and several exchanges now keep one. It is not a guarantee, and no honest page will call it one.

The biggest exchange hack ever already happened, at Bybit

If you want to know how a top exchange handles a disaster at today's scale, you do not need a hypothetical — February 2025 supplied it. Attackers took roughly $1.5 billion in ETH from Bybit, the largest theft in crypto history, attributed by the FBI to North Korea's Lazarus Group.

The mechanism matters more than the number: nothing was wrong with Bybit's own wallet code. The attackers compromised a developer machine at Safe, the third-party multisig interface Bybit used, and injected JavaScript that changed what the transaction looked like on the signers' screens. Executives approved what appeared to be a routine cold-to-warm transfer and signed away the cold wallet. Every security layer held except the screen.

And the outcome for users: Bybit never halted withdrawals, processed a flood of panicked exits through the night, borrowed and bought ETH to plug the gap, and declared reserves fully replenished about 72 hours after the theft. Customer accounts were made whole. The worst hack ever recorded cost its users approximately nothing — because the exchange behind it was solvent, liquid and willing to eat the loss.

When users do lose

That is not the universal script, and pretending otherwise would make this page useless. Here is the honest spread:

Mt. Gox's customers waited a decade for repayments to even begin. WazirX's users spent 15 months locked out and were eventually paid 85.5% of their balances, with the remainder as IOU-style recovery tokens. Coincheck's were reimbursed in full within about two months, and Bybit's within days. The pattern is not subtle: the theft's size decided nothing, the balance sheet and governance behind the exchange decided everything. FTX is deliberately absent from the chart — that was fraud, not hacking — but it teaches the same lesson from a different direction: the exchange itself is the risk container, whoever opens the hole.

That pattern is also why our crypto exchange rating weights security — regulation, custody arrangements, reserve transparency, incident history — heavier than any other component. A fee table tells you what a trade costs; the security column is a judgment on who still owes you money the morning after a headline like today's.

Where your coins actually sit on an exchange

One mental model makes every story above easier to parse. Your exchange balance is a database row; the coins themselves sit in a small number of wallets the exchange controls:

Classic hacks live in the hot layer — that is why Binance lost 2% of its BTC in 2019 and not 100%. The Bybit incident is the uncomfortable 2025 update: a cold wallet's keys were never exposed, and it was still emptied, because the humans signing a cold-wallet transaction can only approve what their screen shows them. Proof-of-reserves snapshots, which most large exchanges including Binance now publish, let you verify assets cover customer balances at a point in time. All of it reduces the odds of disaster; none of it takes the custodian out of the picture.

"Binance got hacked" is not "my Binance account got hacked"

One more distinction today's panic blurs. Everything above is about the exchange being robbed. Far more people lose money to the second thing: their own account being phished — a fake login page, a malware-stolen session, a leaked API key, a SIM swap. SAFU and reimbursement precedents are about platform-level failures; an account emptied with your own credentials is usually investigated case by case, and often ends with "the withdrawal was validly signed".

That risk you can actually engineer away: a hardware security key or passkey instead of SMS codes, an anti-phishing code in every real Binance email, a withdrawal address whitelist so stolen credentials still cannot send coins anywhere new, and API keys with withdrawals disabled. If your account is ever locked or flagged while you sort something out, that is a different problem again — we covered it in why crypto exchange accounts get frozen.

So should you move everything off Binance tonight?

Not on the strength of an unconfirmed rumor, no — and also not only when rumors fly. The sober version, which is the same advice we would write in a quiet week:

Money you are actively trading has to sit on an exchange; that is the cost of trading. Decide its size the way you would decide a position size. Our Binance review covers what the platform is actually good at, and what we would not use it for.

Savings do not belong on any exchange — not Binance, not the one you would flee to. Every story on this page, including the ones with happy endings, happened to custodians. Coins in a wallet whose seed phrase only you hold are outside every number discussed today: there is no hot wallet to drain, no SAFU to hope for, no scheme of arrangement to wait through. For holdings of real size that usually means a hardware wallet, where the keys live in a device that never touches the internet.

And exchanges do not only get hacked — they also simply leave. BitMEX shut down this September in an orderly wind-down with deadlines; LetsExchange closed a week later. A custodian is a counterparty, and counterparties end.

Bottom line

By the time you read this, 29 October will have resolved into one of two stories: a real breach — in which case the SAFU fund, the Bybit precedent and Binance's own 2019 record are exactly the frame for what happens next — or a wallet reshuffle that briefly erased a tenth of BNB's price, which is its own lesson in how much rumor a custodial system is carrying. We will update this page when the facts land, and say which it was.

What does not change either way: the exchange you choose decides whether a hack becomes your loss, so choose on security rather than fee pennies; the split between trading float and self-custodied savings decides how much of you is exposed at all; and the account-level protections are free and take an evening. The question in this page's title has a real answer now, backed by seven years of incidents — for users of well-capitalized exchanges, "the exchange pays"; for everyone else, "eventually, partially, or not". Pick which group you are in before the next red candle, not during it.